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Thank you for the opportunity to offer comments today. I commend the Office of 
the Attorney General for holding this forum on data privacy, an issue of central 
importance to everyday life. 

My name is Alex Propes, and I work with the Interactive Advertising Bureau, or 
“IAB.” Founded in 1996, the IAB represents over 650 leading media and technology 
companies that are responsible for selling, delivering, and optimizing digital advertising 
campaigns. Working with our member companies, the IAB develops technical standards 
and best practices and fields critical research on interactive advertising. We are 
committed to professional development and elevating the knowledge, skills, expertise, 
and diversity of the industry’s workforce. 

Of our 650 member companies, nearly 200 are headquartered across California - 
from San Diego to San Francisco. Our California-based member companies include 
newspapers such as the L.A. Times and Investor’s Business Daily, entertainment 
companies such as Zynga and Electronic Arts, online shopping networks and retailers 
such as shopping.com and StubHub, and technology companies such as OpenX and 
Factual. These companies offer a wide variety of content and services that consumers 
love. And these services are all supported by revenues from online advertising. 

IAB research conducted by Harvard Business School Professor John Deighton 
has found that the advertising-supported digital economy supports over 478,000 full¬ 
time jobs across California, and contributes $178 billion to California’s GDP. 1 We 
believe effective privacy regulation that promotes consumer trust and builds on industry 
best practices can and should promote even greater job creation and economic growth 
in California. 

We support the guiding principles of transparency, control, and accountability 
that are captured in the CCPA. It was in furtherance of these principles that we 
developed the Digital Advertising Alliance, or “DAA,” the cross-industry self-regulatory 
privacy principles which have been widely implemented across the digital advertising 
industry and are a requirement for companies wishing to join the IAB. 2 

The DAA Principles require companies to inform consumers about their data 
practices, and to offer consumers control over the collection, use, and sharing of their 
data. Furthermore, the DAA prohibits the collection, use, and sharing of data for 


x John Deighton, The Economic Value of the Advertising-Supported Internet Ecosystem (January 2017). 

2 Digital Advertising Alliance, Self-Regulatory Principles for Online Behavioral Advertising (July 2009). 



potentially harmful practices such as determining eligibility for employment, credit, 
health care treatment, or insurance. 

While the CCPA seeks to enshrine these important concepts, we are concerned 
that without additional guidance and clarification from the Attorney General, the law 
could result in unintended consequences. Today I would like to highlight a few areas of 
relevance to businesses in the media and marketing industries as they work towards 
CCPA compliance. 

First, it is important that CCPA’s non-discrimination provisions do not 
prevent publishers from charging a reasonable fee as an alternative to using an 
advertising-supported business model. There is a concern the CCPA non¬ 
discrimination provisions will prevent publishers from charging a fee to access their 
content for those consumers that elect to opt out. Publishers, especially small 
publishers, rely on third-party advertising providers to generate revenue to support their 
content and services. It is critical that we avoid requiring websites to grant everyone 
access to their digital sites, even visitors who have opted out, without allowing for some 
paid alternative. We ask the Attorney General to permit a business to charge a 
reasonable fee as an alternative to using an advertising-supported business model. 

Second, it is important that CCPA provide businesses with the flexibility to 
offer reasonable options to consumers with regard to deletion and opt out rights. 

The CCPA allows consumers to opt out entirely of the sale of their data or delete their 
data; but the law does not explicitly permit a business to offer a consumer the choice to 
delete or opt out of some, but not all, of their data. We ask that the Attorney General 
clarify that businesses may offer reasonable options to consumers to choose the types 

of “sales” they want to opt out of and the types of data they want deleted, in addition to 

a general opt out. 

Third, it is important that CCPA provide the needed flexibility for 
businesses to verify consumer requests. In many scenarios in the digital advertising 
industry, businesses have limited ability to verify the legitimacy of consumer requests 
under the CCPA. This difficulty in determining which requests are legitimate and which 
are fraudulent puts consumers and their data at risk from unauthorized requests. We 
ask that the Attorney General recognize that verifying consumer requests may take 

many forms and should refrain from enforcement actions when companies make 

commercially reasonable efforts to verify a consumer. We also ask that the Attorney 

General distinguish between parties that hold data that is purely pseudonymous and 

that have no means of connecting it to a natural person. 

Thank you for the opportunity to speak with you today. We look forward to 
providing more detailed written comments to the Attorney General in the days ahead. 














